Runtime updates to EFI secure variables

Runtime updates to EFI secure variables

[James Bottomley]

I finally managed to get runtime updates to the key databases and the
platform keys to work on the Tianocore UEFI emulator.  The code is in

git://git.kernel.org/pub/scm/linux/kernel/git/jejb/efitools.git

And a description of how to use the tools is here:

http://blog.hansenpartnership.com/updating-pk-kek-db-and-dbx-in-user-mode/

This means (provided we have access to the relevant keys) we can move
the platform into and out of Setup Mode as well as add signing and other
keys.

James

Re: Runtime updates to EFI secure variables

[Matthew Garrett]

On Fri, Jul 13, 2012 at 06:12:26PM +0100, James Bottomley wrote:

> This means (provided we have access to the relevant keys) we can move
> the platform into and out of Setup Mode as well as add signing and other
> keys.

I'm pretty sure that the expected behaviour is to use 
EFI_VARIABLE_APPEND_WRITE for these updates, which means you don't need 
to worry about the timestamp.

-- 
Matthew Garrett | mjg59@srcf.ucam.org

Re: Runtime updates to EFI secure variables

[James Bottomley]

On Fri, 2012-07-13 at 19:02 +0100, Matthew Garrett wrote:
> On Fri, Jul 13, 2012 at 06:12:26PM +0100, James Bottomley wrote:
> 
> > This means (provided we have access to the relevant keys) we can move
> > the platform into and out of Setup Mode as well as add signing and other
> > keys.
> 
> I'm pretty sure that the expected behaviour is to use 
> EFI_VARIABLE_APPEND_WRITE for these updates, which means you don't need 
> to worry about the timestamp.

Actually, as long as the timestamp is current (as in > previous
timstamp) it updates the private timestamp stored with the variable.
It's minor, and you're right, the timestamp could be zero, but it's best
practice.

As far as moving the platform into setup mode, that can only be done by
clearing PK, which has to be a non append write, so I need to worry
about both modes.  It's useful to make sure this works, just in case we
run into some OEM accidentally forgetting to allow a user present reset
to setup mode, because it allows us to create an EFI program for them
that will have the same effect.

James